Catch dependencies before they spoil your work.

Privacy Policy

Last Updated: January 15, 2026

1. Data Controller

Shelf Life ("we", "us", "our") operates as a free GitHub App. For privacy inquiries, contact: support@getshelflife.dev

2. Information We Collect

We collect and process the following data:

• GitHub Installation Data: Installation ID, account type (personal/organization), account login, repository access permissions
• Repository Data: Dependency files (package.json, requirements.txt, pom.xml, etc.) read via GitHub APIs for scanning purposes
• Email Addresses: Email addresses you provide for receiving dependency alerts
• Scan Results: Dependency analysis results stored in Google Cloud Storage and Firestore
• Session Data: Authentication tokens and session cookies for maintaining your login state

3. Legal Basis for Processing

We process your data based on:

• Consent: By installing and using the Shelf Life GitHub App, you consent to data processing necessary for the service
• Legitimate Interest: Processing is necessary to provide the dependency monitoring service you requested

4. How We Use Your Data

We use collected data to:

• Scan your repositories for end-of-life dependencies and security risks
• Send email alerts about dependency issues
• Create PR status checks and comments
• Store scan results and configuration settings
• Maintain your authentication session

5. Data Storage and Third-Party Services

Your data is stored using Google Cloud Platform services:

• Firestore: Stores installation metadata, settings, and scan metadata
• Google Cloud Storage (GCS): Stores scan reports (Markdown/CSV files) with signed URLs
• Cloud Run: Hosts the application services
• Pub/Sub: Processes scan jobs asynchronously

We also use SendGrid for sending email notifications. All third-party services are bound by their respective privacy policies and data processing agreements.

6. Data Retention

We retain your data for as long as:

• Your GitHub App installation remains active
• You have an active account with us
• Required by law or for legitimate business purposes

You may request deletion of your data at any time by uninstalling the GitHub App or contacting us at support@getshelflife.dev.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at support@getshelflife.dev.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS)
• Secure authentication and authorization
• Access controls and audit logging
• Regular security assessments

9. International Data Transfers

Your data may be transferred to and processed in the United States and other countries where Google Cloud Platform operates. We ensure appropriate safeguards are in place for such transfers.

10. Children's Privacy

Our service is not intended for users under 16 years of age. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last Updated" date.

12. Contact Us

For privacy inquiries, data protection requests, or questions about this policy, contact us at:

Email: support@getshelflife.dev